Data might be stored in the US, but Chinese laws and control still apply to Bytedance, regardless of where the data is physically stored.

It's the same reason why multiple data transfer frameworks between the EU and US have been ruled illegal (e.g. Privacy Shield).

US law does not care where the data of its companies is stored and allows for surveillance of non-US citizens. Since EU citizens have a right to privacy, no US company can legally handle EU-citizens data.

Obviously this is bad for trade and business, so there'll always be a new law made to temporarily allow for data transfers. Until it'll be ruled illegal again, and the cycle repeats.

And the funny part is when they ban it from the United States, one of the side-effects is moving all the data out of the US .... removing ... US Citizen data onto foreign land.

Looks like it's mostly stored in Oracle Cloud.